PT-2026-27594

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.4 iPadOS versions prior to 26.4 Description The issue was addressed with improved checks. A remote attacker may cause an unexpected application termination. Recommendations Update to iOS version 26.4. Update to iPadOS...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by the American company Apple for Mac computers. Versions of Apple macOS Tahoe prior to 26.4 contained a security vulnerability caused by a logical issue, which could allow applications to access sensitive user data...

CVE-2026-33345 solidtime vulnerable to IDOR in private projects

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/org/projects/project allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index...

EUVD-2026-14996

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/org/projects/project allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index...

EUVD-2026-14976

Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter...

CVE-2026-33335 Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from window.open calls directly to shell.openExternal without any validation or protocol allowlisting. An attacker who can place ...

CVE-2019-25631

creationtimestamp| type| source ---|---|--- 2026-03-24 12:59:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhsmw6y5pt2i 2026-03-27 18:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mi2p4y3k6g2a...

Malicious Package

Overview fancode-web-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in fancode-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56c163153700b6fef7090e078a98b7c2403088e5c5f487344dc419af8adaa7 The package fancode-web-app was found to contain malicious code. Source: ghsa-malware a933e6c673f3cf2c4cb0e768570b64dcf627ac59e6b29c2e9afd5a5fb3d4396...

MAL-2026-2130 Malicious code in fancode-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56c163153700b6fef7090e078a98b7c2403088e5c5f487344dc419af8adaa7 The package fancode-web-app was found to contain malicious code. Source: ghsa-malware a933e6c673f3cf2c4cb0e768570b64dcf627ac59e6b29c2e9afd5a5fb3d4396...

Security Bulletin: SOAR App Host is using a component with a known vulnerability (CVE-2026-1188)

Summary IBM SOAR App Host uses an older version of the OMR component in OpenJ9 JVM that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 1.15.7.0 Vulnerability Details CVEID:CVE-2026-1188 DESCRIPTIO...

CVE-2026-33286

creationtimestamp| type| source ---|---|--- 2026-03-24 00:23:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrcou436g2d 2026-03-24 02:58:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrle3s3xm2r 2026-03-24 03:00:32+00:00| seen|...

CVE-2026-33176

creationtimestamp| type| source ---|---|--- 2026-03-24 00:01:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrbh4rklw2x...

PT-2026-27529

Name of the Vulnerable Software and Affected Versions macOS versions prior to 26.4 Description A flaw exists in how the operating system parses directory paths. This could allow an application to access sensitive user data due to insufficient path validation. Recommendations Update to macOS versi...

Proton 安全漏洞

Proton is an independent application developed by Steventhanna’s developer, which uses Electron to quickly preview and edit Markdown files. Versions of Proton prior to 1.6.16 have security vulnerabilities; these vulnerabilities stem from out-of-bound writing, which may lead to issues with the...

PT-2026-27562

Name of the Vulnerable Software and Affected Versions macOS versions prior to 26.4 Description A logic issue existed due to insufficient restrictions, allowing a malicious application to potentially escape its sandbox. The issue was resolved by implementing improved restrictions. Recommendations...

CVE-2026-23482

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks...

CVE-2025-60949 Census CSWeb leaked configuration files

Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha...

CVE-2025-60949

Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha...

CVE-2026-23487

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an IDOR vulnerability where user.detail Endpoint Leaks the Superadmin Token. This issue has been patched in version 1.8.4...